
Summary
This rule is designed to monitor and log instances where a role is assumed via the AWS STS (Security Token Service). The specific focus is on identifying if a role in the AWS environment has been assumed by a user rather than by a service. In the provided test case, the system logs an 'AssumeRole' action initiated from a Lambda function. This action includes details such as the AWS region, the event ID, and the role ARN involved. The rule is currently disabled and does not create alerts when triggered, implying it might be used for auditing or testing purposes rather than immediate security response. The significance of monitoring role assumptions lies in ensuring that permissions are correctly assigned and that roles are not being assumed improperly by users or services, which could indicate configuration mismanagement or potential security concerns.
Categories
- Cloud
- AWS
Data Sources
- Cloud Service
- Cloud Storage
Created: 2024-07-15